9.9

CVE-2020-36156

Exploit

Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Mögliche Gegenmaßnahme
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Update to version 2.1.12, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ultimatemember ≫ Ultimate Member SwPlatformwordpress Version < 2.1.12
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Version [*, 2.1.12)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.03% 0.785
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
cve@mitre.org 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://wordpress.org/plugins/ultimate-member/#developers
Third Party Advisory
Release Notes
https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/
Third Party Advisory
Exploit
https://wpscan.com/vulnerability/dd4c4ece-7206-4788-8747-f0c0f3ab0a53
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/f3805936-675e-474f-a3f7-acea69bd72f0
Third Party Advisory